Each request carries a personal API key. Send it in the Authorization header, which is the preferred way:
Authorization: Bearer wht_YOUR_KEYSome apps only let you paste a URL. For those, put the key in the path instead: https://wht.day/mcp/wht_YOUR_KEY. Both reach the same server.
- Creating a key. Sign in, open Settings, find API access, give the key a label such as “Claude”, and press Create API key. The key is shown once, together with an MCP link that has the key built in. Copy them then.
- Format. Keys start with
wht_, followed by 43 random URL-safe characters. - Who can create one. API access is part of a paid subscription, at $8 a month or $68 a year. The subscription is checked on every request: while it is inactive, keys stop working without being revoked, and they work again as soon as it resumes.
- What a key can reach. Only the archive of the account that created it, and only through the read-only tools below. A key can't sign in to the app or change any setting.
- Storage and revoking. WHT.day stores only a SHA-256 hash of each key, plus its first characters so you can tell keys apart. A lost key can't be shown again. Revoke it in API access and create a new one; a revoked key stops working on its next request.
- No OAuth. The server doesn't run an OAuth sign-in flow. The API key is the only credential.
Treat a key, and an MCP link with a key in it, like a password: anyone who has it can read your archive.